Integrating SAP BTP -CPI with Microsoft SharePoint : Part 1 - Establishing Connectivity

[siddhartha_routh]

In today’s digital landscape, businesses rely on a variety of platforms to drive collaboration, data accessibility, and streamline processes. Microsoft SharePoint has emerged as a popular choice for document management and team collaboration, and integrating it with SAP Cloud Platform Integration (CPI) can unlock powerful synergies. Through this integration, both SAP and non-SAP systems can securely interact with SharePoint for document storage, retrieval, and seamless collaboration.
SAP BTP Integration Suite comes with standard Microsoft SharePoint adapter that uses Graph API to communicate with SharePoint to perform various activities such as upload, delete , read , copy and generate sharable link to name a few. 

This three-part blog series will guide us through the essential steps for SAP CPI and SharePoint integration:

• Part 1: Establishing Connectivity — We’ll cover the foundational setup for secure connectivity between SAP CPI and SharePoint, including permissions in Azure AD and OAuth 2.0 configuration in CPI.
• Part 2: Creating an API to Upload Files — We’ll walk through creating a custom HTTP API and exposing it via APIM to enable file uploads to SharePoint.
• Part 3: Reading Files from SharePoint — In the final part, we’ll explore how to use the Microsoft SharePoint sender adapter to read files and perform post-processing actions.

In this first Blog post, we’ll lay the groundwork by establishing connectivity. You’ll learn to configure permissions in Azure Active Directory (AD) and Create Application to use graph API, set up OAuth 2.0 Authorization Code in SAP CPI security materials, and test the connection, ensuring that CPI and SharePoint can securely communicate.

Prerequisites

Validate User and License details. 
When connecting to SharePoint with OAuth2, you need to have an organizational directory/tenant in Microsoft Azure Active Directory and a user in this directory with user type "Member" which has a subscription to SharePoint. 

Determine Redirect URI
Use the BTP Integration Suite tenant <host name> to construct the following redirect URI:

https://<host name>/itspaces/odata/api/v1/OAuthTokenFromCode

For Ex :
https://<clientid>.integrationsuite.cfapps.<region>.hana.ondemand.com/itspaces/odata/api/v1/OAuthTok...

Register a New Application in Azure AD
Step 1: Set Up SharePoint Permissions in Azure Active Directory (AD)

• Log in to the Azure portal and go to Azure Active Directory.
•  Navigate to App registrations and select New registration.

• Fill in the following details:
  • Name: Enter a descriptive name, such as “SAP_CPI_SharePoint_Integration”.
  • Supported account types: Choose based on your organization’s requirements.
  • Redirect URI : Determined in the prerequisite section above. 

       

• After registering, make a note of the Application (client) ID and Directory (tenant) ID—you’ll use these later in CPI.
  
  
•  Choose "Certificates & secrets" in the menu on the left and create a new Client Secret with your preferred expiry period. 
  
• Go back to the "Overview" view of the app and select the "Endpoints" tab. Copy the "OAuth 2.0 authorization endpoint (v2)" and the "OAuth 2.0 token endpoint (v2)" to your local desktop. You need these values later for the creation of the OAuth2 credential in Cloud Integration.

Step 2 : Configure API Permissions

• In the application’s settings, go to "API permissions" and remove the permission "User.Read" if it is there.

• Click Add a permission > Microsoft Graph > Application permissions. Select Delegated Permissions and Under Sites, select "Sites.ReadWrite.All" to allow full access to SharePoint files. Confirm permissions by adding the permission to the application. 
  

  

Create an OAuth2 Authorization Code Credential in SAP CPI Tenant

1. Log into your Cloud Integration tenant and select the "Security Materials" tile under "Monitor->Integrations and APIs" section. Select the "Create" button and choose "OAuth2 Authorization Code".
2. Enter Name and Other details that were captured earlier when the application was created. Please make sure to select provider as "Microsoft 365"
   
3. Enter Application ID as "Client ID" , "Client Secret" , "Authorization URL" and "Token Service URL" captured in above steps from the Microsoft application . Enter the "User Name". This is the e-mail address of the service user that exists in Microsoft Azure directory/tenant as a member and has the requisite permission in which the App was created ( Discussed in the prerequisite section ).
   
   Also add the "Scope" as "https://graph.microsoft.com/.default offline_access"
   On deploying the security materials , we can see the newly created "OAuth2 Authorization Code" credential in the list of Security Materials in status "Unauthorized".

   Select the three dots in the entry with the created credential and choose the "Authorize" option shown above. A confirmation dialog will come up. Select "Continue":

   
4. A Microsoft login appears , please enter the password for the service user created for the above integration. 
    
5. Once Authenticated , additional dialog requests further permission and shows the scope of the application created above. Please accept and proceed .  
   
6. On successful confirmation below success message is displayed and the security material is now authorized. 
   
   

   
   Conclusion

   In this post, we successfully established secure connectivity between SAP CPI and Microsoft SharePoint by configuring permissions in Azure Active Directory and setting up OAuth 2.0 credentials in CPI. With this foundation, CPI can now securely authenticate with SharePoint, paving the way for seamless file interactions. 

   In our next post, we’ll build on this connection by creating an HTTP endpoint and exposing it through API Management (APIM), enabling boundary applications to upload files directly to SharePoint. Stay tuned for Part 2, where we’ll dive into API creation and management to further enhance our CPI-SharePoint integration.
   
   Resources referred when writing the blog
   https://help.sap.com/docs/integration-suite/sap-integration-suite/microsoft-sharepoint-adapter 
   Connect to Microsoft 365 Mail with OAuth2 

[Saumya09]

Nicely explained! Thanks for sharing.

[EmilianoAyub]

nice one.. keep it up!

[hariprasad24]

Indetail.  Thank you. Looking forward for the next blog.  We are looking for this type of blog from long time where we can find all the steps needed to implement this solution but we end up with bits and pieces.  Your blog helps to find all inputs at one place.  Kudos. @siddhartha_routh 👏

[KaushikCPI]

Thanks @siddhartha_routh, this blog was really helpful.